Censys

The Internet is vast and volatile. Two years of Internet intelligence from Censys ARC, distilled into what’s changing, what’s staying the same, and what it means for your security team. Inside the 2026 State of the Internet Report: ▪The rapid growth of exposed AI infrastructure ▪Shifting threat actor infrastructure ▪Persistent risk in enterprise software and industrial control systems

Our fifth annual report reveals Internet-facing AI infrastructure grew 63% in just nine months, reaching nearly 268,000 systems. And that’s only one shift happening across the Internet. Drawing on more than 2 years historical and real-time data from the Censys Internet Map, Censys ARC examines how infrastructure, exposure, and threats are evolving globally.

AI in cyber can be helpful, but it also can get us to the wrong answer faster. Security has moved AI out of the pilot phase and the data shows it, such as IBM's 2026 Cost of a Data Breach Report, which found more than 50% of organizations now use agents for threat detection and containment. But those agents are only as good as the data they can see, and most of that data describes what is happening inside the organization. We've spent a decade of SecOps investment on endpoints, logs, cloud posture and identity and rightfully so, but attackers start from an outside-in view and many organizations can't see their own external footprint as well as an attacker can. Meanwhile exploitation of Internet-reachable systems remains a top initial access vector, yet only about 25% of critical KEV's ever get remediated. An agent pivoting on an IOC without external context can end up flagging legitimate users while missing the attackers and their view from the outside. I suspect that the AI SOC of two years from now will be judged on what its agents are allowed to see, along with the security implications of that access. In my recent Resilient Cyber piece I dug into using external Internet intelligence from Resilient Cyber's partner Censys along with their 2026 State of the Internet Report, including 267,915 hosts that now expose AI or LLM tooling to the Internet, which up 63% in just nine months. https://lnkd.in/e4Ne8k_T

Imagine if the entire internet was scanned and we knew what was exposed across all 65,535 ports. Well, it was and here are the results: Thirty years ago I remember dialing into the internet. I connected, surfed the web, checked email and then disconnected so my dad could have the phone line back to make calls. Today everything is connected, all the time. As someone who went on to work as a penetration tester for years, it was always amazing to me that we're only milliseconds away from nearly any connected device in the world, digitally. However, what started as a fascination has become scary. The shape of the internet as a whole, has become a nightmare. There's a report that just came out called the "2026 State of the Internet Report" that includes data from the entire internet, literally. The report was written by Censys, who scans 218 million hosts, 17 billion certificates, and 2.4 billion web properties. They scan the entire IPv4 address space across 65,535 ports and leverage DNS to discover IPv6 systems and detect more than 200 protocols. This year the report focuses on 5 key areas of internet exposure: 1. The Shape of the Internet: the biggest takeaway here is that services aren't living on default ports. 34% of SSH, 68% of HTTP(S) and 96% of SOCKS proxies are running on non-standard ports. The issue here is that security practitioners and detection methods typically look in default places. This makes it extremely hard for an organization to understand what's exposed. 2. Vulnerability Response: If software is old, it probably isn't going to be updated. Four case studies done over two years showed that older software wasn't really being updated. Middle aged software saw the largest share of updates. So those older systems still hanging around are extremely dangerous. 3. Industrial Control Systems and Critical Infrastructure: As of 2026, North America leads in ICS exposures. This represents 38% of the global ICS landscape. Over 80% of ICS systems run non-ICS services like HTTP, SSH, or FTP, increasing the attack surface. 4. Threat Infrastructure and Adversary Tools: Across the globe, China and the U.S. host most of the world's malicious software and services. China hosts 36.6% of malicious host-level infrastructure (C2s). The U.S holds 45.5% of web based threats like phishing and other deceptive pages. 5. Exposed AI Infrastructure: 267,915 unique hosts were observed exposing AI/LLM related tools. This rose 63% in just nine months. A recognizable AI infrastructure stack is emerging on the public internet. Exposed systems across 20+ categories were seen forming the layers needed to operate AI workflows. I've only touched lightly on these 5 categories, but this is easily the best report I've read this year. It's important that we understand exposure and the risks that come with it. Check out the report at: https://tr.ee/45hqnV Thank you Censys for letting me partner with you so I could share this information.

The wait is over. Our 2026 State of the Internet Report is here. The Internet is vast. And volatile. Drawing on more than two years of Internet intelligence, Censys ARC examines what's changing, what's staying the same, and what it means for security teams. From the rapid growth of exposed AI infrastructure to shifting threat actor infrastructure and persistent risks across enterprise software and industrial control systems, the report reveals where the Internet is evolving fastest and where exposures aren't going away. Download the 2026 State of the Internet Report: https://lnkd.in/gudcj4J2/?utm_campaign=Boost_Post_WebsiteVisits_Oct16,2026&utm_source=linkedin&utm_medium=paid&utm_id=1232769944&hsa_acc=506425840&hsa_cam=1232769944&hsa_grp=903678184&hsa_ad=1600758734&hsa_net=linkedin&hsa_ver=3

The Internet is changing. Are you keeping up? Censys' 2026 State of the Internet Report reveals the trends reshaping the global attack surface, from rapidly expanding AI infrastructure and persistent industrial control system (ICS) exposures to evolving threat infrastructure. Get the latest insights from Censys ARC researchers and understand what these shifts mean for your security strategy. Download the report today.